Medical service regulation method based on network intrusion behavior perception

Abstract

The present invention relates to a medical service regulation method based on network intrusion behavior perception, comprising: scheduling and sorting all real-time medical service tasks and non-real-time medical service tasks to obtain multiple scheduling queues; generating a corresponding attack behavior relationship network based on historical vulnerability information of service nodes, mapping an alarm sequence composed of multiple coarse-grained alarm information of the service nodes to the attack behavior relationship network to obtain an attack evolution sequence of the current network intrusion behavior, determining a first threat feature and a second threat feature of the network intrusion behavior based on the alarm sequence and the attack evolution sequence, determining the threat degree of the network intrusion behavior based on the first threat feature and the second threat feature of the network intrusion behavior, and adopting an execution configuration strategy that maximizes spatial heterogeneous diversity or an execution configuration strategy that maximizes temporal diversity for the medical service tasks in the scheduling queue according to the threat degree of the network intrusion behavior.

Description

Technical Field

[0001] The present invention relates to the fields of smart medical care and network security, and in particular to a medical service regulation method based on network intrusion behavior perception. Background Art

[0002] As network systems grow increasingly complex and expansive, and especially as cyberattacks and sabotage become increasingly prevalent and diverse, network security faces significant challenges. Conducting security risk assessments and implementing appropriate defense strategies is a crucial means of understanding the current and future security status of network information systems. This approach is crucial for minimizing or eliminating the damage caused by various attacks.

[0003] The threat landscape faced by computing nodes in cloud environments is constantly changing, especially in the field of medical cloud services. Existing defense strategies do not consider the business service quality of cloud computing nodes when encountering or defending against network intrusions, resulting in excessive resources being used to defend against network attacks, affecting the progress and quality of the service itself. Summary of the Invention

[0004] In view of the shortcomings of the existing technology, the present invention provides a medical service regulation method based on network intrusion behavior perception, including:

[0005] Based on the delay sensitivity of each medical service task, each medical service task is divided into a real-time medical service task and a non-real-time medical service task, and each real-time medical service task is marked with a different priority field according to the delay requirement of each real-time medical service task. All real-time medical service tasks and non-real-time medical service tasks are scheduled and sorted according to the priority field to form multiple scheduling queues on the corresponding service node;

[0006] Extracting an action node set and a state node set of historical network intrusion behaviors based on historical vulnerability information of the service node, and constructing each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set and the state node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit;

[0007] Add corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and update the attack behavior relationship network, extract the first threat feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the service node, map the alarm sequence composed of multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior, and obtain the second threat feature of the current network intrusion behavior based on the attack evolution sequence analysis, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the service node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node;

[0008] The threat level of the network intrusion behavior is determined based on the first threat feature and the second threat feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, an execution configuration strategy that maximizes spatial heterogeneous diversity is adopted for the non-real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, an execution configuration strategy that maximizes temporal diversity is adopted for the real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with reduced security.

[0009] According to a preferred embodiment, adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes:

[0010] Determine the access complexity and authentication complexity of the corresponding system vulnerability on the service node based on the historical vulnerability information of the service node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the service node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity, and historical access frequency of the system vulnerability;

[0011] The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node;

[0012] Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node;

[0013] Identify and parse new vulnerability information of the service node, add the single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on the predecessor state condition when the single-step attack action node is triggered, increase the node attribute of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

[0014] According to a preferred embodiment, mapping the alarm sequence composed of multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior includes:

[0015] Mapping each coarse-grained alarm information arranged in chronological order in the alarm sequence to the corresponding single-step attack action node in the updated attack behavior relationship network, and using the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence;

[0016] Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node;

[0017] Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information.

[0018] The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

[0019] According to a preferred embodiment, the step of generating the path sequence is: starting from the corresponding attack observation node, forward searching all subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node, until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

[0020] According to a preferred embodiment, determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes:

[0021] The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node;

[0022] The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

[0023] According to a preferred embodiment, when determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes:

[0024] Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the service node has reached the maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the service node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the service node returns to normal.

[0025] According to a preferred embodiment, when determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes:

[0026] Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the service node is maximum or whether the previous neighboring execution configuration strategy of the service node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the service node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the service node returns to normal.

[0027] According to a preferred embodiment, the execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a non-real-time medical service task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties in different time segments for a real-time medical service task, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

[0028] According to a preferred embodiment, each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains the corresponding authority or occupies the corresponding resource.

[0029] The present invention has the following beneficial effects:

[0030] The medical service control method based on network intrusion behavior perception provided by the present invention maps the alarm sequence of the service node to the attack behavior relationship network template constructed according to the historical network intrusion behavior of the service node, so as to perform evolutionary analysis on the current network intrusion behavior to obtain the corresponding attack evolution sequence, so that the present invention can more accurately perceive the threat level of the network intrusion behavior, and adopt an adaptive execution configuration strategy for the medical service tasks in the scheduling queue according to the threat level of the network intrusion behavior, so that when the threat level is high, the system increases the defense capability and guarantees the service quality at the same time, and when the threat level is reduced, the defense capability is reduced and the service quality is improved at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of a medical service regulation method based on network intrusion behavior perception is provided as an exemplary embodiment. DETAILED DESCRIPTION

[0032] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of this document. Obviously, the embodiments described are only part of the embodiments of this document, not all of the embodiments. Based on the embodiments of this document, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this document.

[0033] It should be noted that, unless otherwise defined, technical or scientific terms used in one or more embodiments of this specification should have the same general meaning as those generally understood by persons skilled in the art in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in one or more embodiments of this specification do not denote any order, quantity, or importance, but are merely used to distinguish different components.

[0034] Words such as "include" or "comprising" mean that the elements or objects listed after the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects. Words such as "upper," "lower," "left," and "right" are used only to indicate relative positions. When the absolute position of the objects being described changes, the relative position may also change accordingly.

[0035] See also Figure 1 In one embodiment, a medical service regulation method based on network intrusion behavior perception may include:

[0036] S1. Based on the delay sensitivity of each medical service task, each medical service task is divided into real-time medical service tasks and non-real-time medical service tasks. Different priority fields are marked for each real-time medical service task according to the delay requirements of each real-time medical service task. All real-time medical service tasks and non-real-time medical service tasks are scheduled and sorted according to the priority fields to form multiple scheduling queues on the corresponding service nodes.

[0037] Optionally, the real-time medical service task is a medical service task that is sensitive to delay, and extending or shortening the response time of the medical service task will affect the service quality; the non-real-time medical service task is a medical service task that is not sensitive to delay, and the response time of the medical service task can be extended or shortened within a certain period of time without affecting the service quality.

[0038] Optionally, the delay requirement is a maximum response time of a corresponding real-time medical service task that will result in a reduction in service quality. The scheduling queue includes a plurality of real-time medical service tasks arranged in order of priority indicated by a priority field and non-real-time medical service tasks arranged in order of maximum response time.

[0039] The maximum response delay represents the maximum time period that can be extended or shortened for a non-real-time medical service task without affecting the service quality.

[0040] S2. Extract the action node set and state node set of the historical network intrusion behavior based on the historical vulnerability information of the service node, and construct each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit.

[0041] Optionally, each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains corresponding permissions or occupies corresponding resources.

[0042] Optionally, the historical vulnerability information is composed of vulnerability information of all system vulnerabilities that have been attacked in the history of the service node, and the historical vulnerability information includes the access complexity, authentication complexity, number of attacks, and attack frequency of each system vulnerability;

[0043] The simulated network intrusion behavior is used to simulate and reconstruct the attack action and state of each historical network intrusion behavior, so as to construct a more accurate network graph template for a newly generated network intrusion behavior.

[0044] S3. Add corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and update the attack behavior relationship network, extract the first threat feature of the current network intrusion behavior based on the multiple coarse-grained alarm information generated in real time by the service node, map the alarm sequence composed of the multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior, and obtain the second threat feature of the current network intrusion behavior based on the attack evolution sequence analysis, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the service node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node.

[0045] Optionally, the coarse-grained alarm information is generated by the service node based on vulnerability information of the attacked system vulnerability, attacker information and attack time analysis, and the attacker information includes the attacker's IP address, port number and network protocol used; the first threat feature is used to characterize the threat type, severity, attack frequency and propagation method of the corresponding network intrusion behavior, and the threat type is used to identify predefined threat event types, including distributed denial of service attacks, illegal access and traffic anomalies.

[0046] Optionally, the second threat feature is used to characterize the historical attack frequency, threat type and propagation mode of the evolving intrusion behavior indicated by the attack evolution sequence of the corresponding network intrusion behavior.

[0047] Specifically, adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes:

[0048] Determine the access complexity and authentication complexity of the corresponding system vulnerability on the service node based on the historical vulnerability information of the service node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the service node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity, and historical access frequency of the system vulnerability;

[0049] The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node;

[0050] Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node;

[0051] Identify and parse new vulnerability information of the service node, add the single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on the predecessor state condition when the single-step attack action node is triggered, increase the node attribute of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

[0052] Optionally, the pre-condition is used to indicate the system permissions or system resources that need to be obtained in advance when the attack action corresponding to the single-step attack action node is triggered.

[0053] Optionally, the attack success probability corresponding to the single-step attack action node is determined by the product of the access complexity and authentication complexity of the corresponding system vulnerability. The log data of the service node is used to record important events occurring on the service node, including transaction logs and system software and hardware failure information. The system software and hardware failure information includes vulnerability information of the system vulnerability and historical network intrusion behavior information.

[0054] Optionally, the present invention sets the near time period to be within one month with the current time point as the reference time. The historical access frequency is determined by the total number of times the corresponding system vulnerability was accessed within one month, and the total number includes both the number of normal access behaviors and the number of abnormal access behaviors (network intrusions).

[0055] Specifically, mapping the alarm sequence composed of multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior includes:

[0056] Mapping each coarse-grained alarm information arranged in chronological order in the alarm sequence to the corresponding single-step attack action node in the updated attack behavior relationship network, and using the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence;

[0057] Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node;

[0058] Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information.

[0059] The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

[0060] Optionally, the prior attack probability of the corresponding attack observation node is determined by the product between the node transfer probability indicated by the edge weight of the attack observation node and the first local conditional probability indicated by the node attribute, and the product between the node transfer probability and the second local conditional probability, that is, the product between the node transfer probability and the first local conditional probability and the product between the node transfer probability and the second local conditional probability are added to obtain the prior attack probability of the corresponding attack observation node.

[0061] Optionally, the historical verification rate is the probability that the service node generates an alarm when an attack occurs, and the historical false alarm rate is the probability that the service node generates an alarm when an attack does not occur, both of which are obtained from the historical coarse-grained alarm information statistics of the service node.

[0062] The alarm confidence is used to characterize the authenticity of the corresponding coarse-grained alarm information. The calculation formula of the alarm confidence is:

[0063]

[0064] Among them, P i is the alarm confidence of coarse-grained alarm information i, d i is the historical verification rate of the attack action corresponding to the coarse-grained alarm information i, f i is the historical false alarm rate of the attack action corresponding to the coarse-grained alarm information i, p(v i ) is the attack observation node v i The prior attack probability of is the attack observation node v i The probability that no attack occurs.

[0065] Optionally, the step of generating the path sequence is: taking the corresponding attack observation node as the starting point, forward searching all the subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all the subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node, until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

[0066] Specifically, determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes:

[0067] The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node;

[0068] The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

[0069] Optionally, the preset confidence threshold is a value pre-set by the system for determining whether the corresponding coarse-grained alarm information is true alarm information. Coarse-grained alarm information with an alarm confidence greater than the preset confidence threshold is true alarm information, and coarse-grained alarm information with an alarm confidence less than or equal to the preset confidence threshold is false alarm information, that is, a false alarm.

[0070] S4. Determine the threat level of the network intrusion behavior based on the first threat feature and the second threat feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity for the non-real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, adopt an execution configuration strategy that maximizes temporal diversity for the real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with reduced security.

[0071] Optionally, the preset threat level threshold is a system-preset threshold used to characterize the tolerance limit of the service node to abnormal behavior.

[0072] Optionally, when determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes:

[0073] Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the service node has reached the maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the service node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the service node returns to normal.

[0074] Optionally, when determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes:

[0075] Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the service node is maximum or whether the previous neighboring execution configuration strategy of the service node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the service node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the service node returns to normal.

[0076] Optionally, the execution process of the service node has an initialization scheduling period determined according to the attack frequency and attack period of historical network intrusion behavior. When the service performance of the service node returns to normal, the service node automatically restores the current scheduling period to the initialization scheduling period.

[0077] Optionally, the execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a non-real-time medical service task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties in different time segments for a real-time medical service task, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

[0078] In the present invention, the execution configuration strategy that maximizes spatial heterogeneity diversity performs multiple redundant execution processes in parallel within the same time segment, which will greatly improve system security and at the same time increase the response delay of service tasks;

[0079] The execution configuration strategy that maximizes temporal diversity executes different execution processes in different time segments. Compared with the configuration strategy that maximizes spatial heterogeneous diversity, it will reduce system security and shorten the response delay of service tasks.

[0080] The medical service control method based on network intrusion behavior perception provided by the present invention maps the alarm sequence of the service node to the attack behavior relationship network template constructed according to the historical network intrusion behavior of the service node, so as to perform evolutionary analysis on the current network intrusion behavior to obtain the corresponding attack evolution sequence, so that the present invention can more accurately perceive the threat level of the network intrusion behavior, and adopt an adaptive execution configuration strategy for the medical service tasks in the scheduling queue according to the threat level of the network intrusion behavior, so that when the threat level is high, the system increases the defense capability and guarantees the service quality at the same time, and when the threat level is reduced, the defense capability is reduced and the service quality is improved at the same time.

[0081] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the inventions claimed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not claimed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0082] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A medical service control method based on network intrusion behavior perception, characterized in that: The method comprises: Based on the delay sensitivity of each medical service task, each medical service task is divided into a real-time medical service task and a non-real-time medical service task, and each real-time medical service task is marked with a different priority field according to the delay requirement of each real-time medical service task. All real-time medical service tasks and non-real-time medical service tasks are scheduled and sorted according to the priority field to form multiple scheduling queues on the corresponding service node; Extracting an action node set and a state node set of historical network intrusion behaviors based on historical vulnerability information of the service node, and constructing each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set and the state node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit; Add corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and update the attack behavior relationship network, extract the first threat feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the service node, map the alarm sequence composed of multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior, and obtain the second threat feature of the current network intrusion behavior based on the attack evolution sequence analysis, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the service node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node; The threat level of the network intrusion behavior is determined based on the first threat feature and the second threat feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, an execution configuration strategy that maximizes spatial heterogeneous diversity is adopted for the non-real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, an execution configuration strategy that maximizes temporal diversity is adopted for the real-time medical service tasks in the scheduling queue to shift the execution process of the current service node to an execution direction with reduced security.

2. The method according to claim 1, characterized in that Adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes: Determine the access complexity and authentication complexity of the corresponding system vulnerability on the service node based on the historical vulnerability information of the service node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the service node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity, and historical access frequency of the system vulnerability; The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node; Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node; Identify and parse new vulnerability information of the service node, add the single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on the predecessor state condition when the single-step attack action node is triggered, increase the node attribute of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

3. The method according to claim 2, characterized in that Mapping the alarm sequence composed of multiple coarse-grained alarm information of the service node to the updated attack behavior relationship network to obtain the attack evolution sequence of the current network intrusion behavior includes: Mapping each coarse-grained alarm information arranged in chronological order in the alarm sequence to the corresponding single-step attack action node in the updated attack behavior relationship network, and using the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence; Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node; Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information. The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

4. The method according to claim 3, characterized in that The path sequence generation step is as follows: starting from the corresponding attack observation node, forward searching all subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

5. The method according to claim 4, characterized in that The step of determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes: The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node; The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

6. The method according to claim 5, characterized in that When determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes: Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the service node has reached the maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the service node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the service node returns to normal.

7. The method according to claim 6, characterized in that When determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes: Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the service node is maximum or whether the previous neighboring execution configuration strategy of the service node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the service node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the service node returns to normal.

8. The method according to claim 7, characterized in that The execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a non-real-time medical service task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties in different time segments for a real-time medical service task, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

9. The method according to claim 8, characterized in that Each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains the corresponding authority or occupies the corresponding resource.

Images